There are known program management systems capable of detecting an anomaly (malfunction, etc.) in a program installed in a vehicle (i.e., vehicle control device). Specifically, in response of receipt of a request for a control parameter from a management device, a CPU mounted in a vehicle transmits the requested control parameter to the management device. The management device determines whether or not the content of the control parameter is within the range of an expected value based on the content (history) stored in the management device, and thereby detects any anomaly (malfunction, etc.) in a program installed in the vehicle. (Refer to Patent Document 1, for example.)    Patent Document 1: JP-B1-3325899 (U.S. Pat. No. 5,815,071)
However, the above program management system involves a problem. If any anomaly occurs in a program with the control parameter transmitting function maintained, the management device receives the control parameter as an appropriate one. Therefore, there are cases where an anomaly in a program cannot be detected in the above system. An example will be taken. A program referred to by the CPU in the vehicle may be rewritten by a malicious person as a fraudulent control program having a function of transmitting a control parameter in response to receipt of a request for the control parameter. In this case, the program is brought into the state of an “anomaly with the control parameter transmitting function maintained,” and this anomaly cannot be detected at the management device.